@dxos/client-services 0.8.4-main.b97322e → 0.8.4-main.bcb3aa67d6

package/src/packlets/identity/identity.ts

@@ -4,40 +4,39 @@
 
 import { Event } from '@dxos/async';
 import { AUTH_TIMEOUT, LOAD_CONTROL_FEEDS_TIMEOUT } from '@dxos/client-protocol';
-import { type Context } from '@dxos/context';
+import { type Context as DxosContext } from '@dxos/context';
 import {
-  DeviceStateMachine,
   type CredentialSigner,
-  createCredentialSignerWithKey,
-  createCredentialSignerWithChain,
+  DeviceStateMachine,
   ProfileStateMachine,
+  createCredentialSignerWithChain,
+  createCredentialSignerWithKey,
 } from '@dxos/credentials';
 import { type Signer } from '@dxos/crypto';
 import { type Space } from '@dxos/echo-pipeline';
 import { type EdgeConnection } from '@dxos/edge-client';
-import { writeMessages, type FeedWrapper } from '@dxos/feed-store';
+import { type FeedWrapper, writeMessages } from '@dxos/feed-store';
 import { invariant } from '@dxos/invariant';
-import { type IdentityDid, PublicKey, type SpaceId } from '@dxos/keys';
+import { type IdentityDid, PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { type Runtime } from '@dxos/protocols/proto/dxos/config';
 import { type FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
 import {
   AdmittedFeed,
+  type Credential,
   type DeviceProfileDocument,
   type ProfileDocument,
-  type Credential,
 } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type DeviceAdmissionRequest } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type Presence } from '@dxos/teleport-extension-gossip';
-import { Timeframe } from '@dxos/timeframe';
 import { trace } from '@dxos/tracing';
 import { type ComplexMap, ComplexSet } from '@dxos/util';
 
-import { TrustedKeySetAuthVerifier } from './authenticator';
-import { DefaultSpaceStateMachine } from './default-space-state-machine';
 import { EdgeFeedReplicator } from '../spaces';
 
-export type IdentityParams = {
+import { TrustedKeySetAuthVerifier } from './authenticator';
+
+export type IdentityProps = {
   did: IdentityDid;
   identityKey: PublicKey;
   deviceKey: PublicKey;
@@ -59,7 +58,6 @@ export class Identity {
   private readonly _presence?: Presence;
   private readonly _deviceStateMachine: DeviceStateMachine;
   private readonly _profileStateMachine: ProfileStateMachine;
-  private readonly _defaultSpaceStateMachine: DefaultSpaceStateMachine;
   private readonly _edgeFeedReplicator?: EdgeFeedReplicator = undefined;
 
   public readonly authVerifier: TrustedKeySetAuthVerifier;
@@ -70,7 +68,7 @@ export class Identity {
 
   public readonly stateUpdate = new Event();
 
-  constructor(params: IdentityParams) {
+  constructor(params: IdentityProps) {
     this.space = params.space;
     this._signer = params.signer;
     this._presence = params.presence;
@@ -90,10 +88,6 @@ export class Identity {
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit(),
     });
-    this._defaultSpaceStateMachine = new DefaultSpaceStateMachine({
-      identityKey: this.identityKey,
-      onUpdate: () => this.stateUpdate.emit(),
-    });
 
     this.authVerifier = new TrustedKeySetAuthVerifier({
       trustedKeysProvider: () => new ComplexSet(PublicKey.hash, this.authorizedDeviceKeys.keys()),
@@ -111,32 +105,26 @@ export class Identity {
     return this._deviceStateMachine.authorizedDeviceKeys;
   }
 
-  get defaultSpaceId(): SpaceId | undefined {
-    return this._defaultSpaceStateMachine.spaceId;
-  }
-
   @trace.span()
-  async open(ctx: Context): Promise<void> {
+  async open(ctx: DxosContext): Promise<void> {
     await this._presence?.open();
     await this.space.spaceState.addCredentialProcessor(this._deviceStateMachine);
     await this.space.spaceState.addCredentialProcessor(this._profileStateMachine);
-    await this.space.spaceState.addCredentialProcessor(this._defaultSpaceStateMachine);
     if (this._edgeFeedReplicator) {
       this.space.protocol.feedAdded.append(this._onFeedAdded);
     }
     await this.space.open(ctx);
   }
 
-  public async joinNetwork(): Promise<void> {
-    await this.space.startProtocol();
+  public async joinNetwork(ctx: DxosContext): Promise<void> {
+    await this.space.startProtocol(ctx);
     await this._edgeFeedReplicator?.open();
   }
 
   @trace.span()
-  async close(ctx: Context): Promise<void> {
+  async close(ctx: DxosContext): Promise<void> {
     await this._presence?.close();
     await this.authVerifier.close();
-    await this.space.spaceState.removeCredentialProcessor(this._defaultSpaceStateMachine);
     await this.space.spaceState.removeCredentialProcessor(this._profileStateMachine);
     await this.space.spaceState.removeCredentialProcessor(this._deviceStateMachine);
 
@@ -146,7 +134,7 @@ export class Identity {
 
     await this._edgeFeedReplicator?.close();
 
-    await this.space.close();
+    await this.space.close(ctx);
   }
 
   async ready(): Promise<void> {
@@ -210,15 +198,6 @@ export class Identity {
     return createCredentialSignerWithKey(this._signer, this.deviceKey);
   }
 
-  async updateDefaultSpace(spaceId: SpaceId): Promise<void> {
-    const credential = await this.getDeviceCredentialSigner().createCredential({
-      subject: this.identityKey,
-      assertion: { '@type': 'dxos.halo.credentials.DefaultSpace', spaceId },
-    });
-    const receipt = await this.controlPipeline.writer.write({ credential: { credential } });
-    await this.controlPipeline.state.waitUntilTimeframe(new Timeframe([[receipt.feedKey, receipt.seq]]));
-  }
-
   async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }: DeviceAdmissionRequest): Promise<Credential> {
     log('Admitting device:', {
       identityKey: this.identityKey,

package/src/packlets/invitations/device-invitation-protocol.test.ts

@@ -2,7 +2,7 @@
 // Copyright 2022 DXOS.org
 //
 
-import { describe, expect, test, onTestFinished } from 'vitest';
+import { describe, expect, onTestFinished, test } from 'vitest';
 
 import { chain } from '@dxos/async';
 import { Context } from '@dxos/context';

package/src/packlets/invitations/device-invitation-protocol.ts

@@ -6,7 +6,7 @@ import { getCredentialAssertion } from '@dxos/credentials';
 import { invariant } from '@dxos/invariant';
 import { type Keyring } from '@dxos/keyring';
 import { type PublicKey } from '@dxos/keys';
-import { AlreadyJoinedError, type ApiError } from '@dxos/protocols';
+import { AlreadyJoinedError } from '@dxos/protocols';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import type { DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import {
@@ -15,14 +15,15 @@ import {
   type IntroductionRequest,
 } from '@dxos/protocols/proto/dxos/halo/invitations';
 
+import { type Identity, type JoinIdentityProps } from '../identity';
+
 import { type InvitationProtocol } from './invitation-protocol';
-import { type Identity, type JoinIdentityParams } from '../identity';
 
 export class DeviceInvitationProtocol implements InvitationProtocol {
   constructor(
     private readonly _keyring: Keyring,
     private readonly _getIdentity: () => Identity,
-    private readonly _acceptIdentity: (identity: JoinIdentityParams) => Promise<Identity>,
+    private readonly _acceptIdentity: (identity: JoinIdentityProps) => Promise<Identity>,
   ) {}
 
   toJSON(): object {
@@ -31,7 +32,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
     };
   }
 
-  checkCanInviteNewMembers(): ApiError | undefined {
+  checkCanInviteNewMembers(): Error | undefined {
     return undefined;
   }
 
@@ -70,7 +71,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
     try {
       const identity = this._getIdentity();
       if (identity) {
-        return new AlreadyJoinedError('Currently only one identity per client is supported.');
+        return new AlreadyJoinedError({ message: 'Currently only one identity per client is supported.' });
       }
     } catch {
       // No identity.

package/src/packlets/invitations/edge-invitation-handler.ts

@@ -19,8 +19,8 @@ import { schema } from '@dxos/protocols/proto';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import { type DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import {
-  type AdmissionResponse,
   type AdmissionRequest,
+  type AdmissionResponse,
   type SpaceAdmissionRequest,
 } from '@dxos/protocols/proto/dxos/halo/invitations';
 
@@ -126,7 +126,7 @@ export class EdgeInvitationHandler implements FlowLockHolder {
 
       guardedState.set(this, Invitation.State.CONNECTING);
 
-      const response = await this._joinSpaceByInvitation(guardedState, spaceId, {
+      const response = await this._joinSpaceByInvitation(ctx, guardedState, spaceId, {
         identityKey: admissionRequest.identityKey.toHex(),
         invitationId: guardedState.current.invitationId,
       });
@@ -153,13 +153,14 @@ export class EdgeInvitationHandler implements FlowLockHolder {
   }
 
   private async _joinSpaceByInvitation(
+    ctx: Context,
     guardedState: GuardedInvitationState,
     spaceId: SpaceId,
     request: JoinSpaceRequest,
   ): Promise<JoinSpaceResponseBody> {
     invariant(this._client);
     try {
-      return await this._client.joinSpaceByInvitation(spaceId, request);
+      return await this._client.joinSpaceByInvitation(ctx, spaceId, request);
     } catch (error: any) {
       if (error instanceof EdgeAuthChallengeError) {
         const publicKey = guardedState.current.guestKeypair?.publicKey;
@@ -168,7 +169,7 @@ export class EdgeInvitationHandler implements FlowLockHolder {
           throw error;
         }
         const signature = sign(Buffer.from(error.challenge, 'base64'), privateKey);
-        return this._client.joinSpaceByInvitation(spaceId, {
+        return this._client.joinSpaceByInvitation(ctx, spaceId, {
           ...request,
           signature: Buffer.from(signature).toString('base64'),
         });

package/src/packlets/invitations/invitation-guest-extenstion.ts

@@ -3,7 +3,7 @@
 //
 
 import { type Mutex, type MutexGuard, Trigger } from '@dxos/async';
-import { cancelWithContext, Context } from '@dxos/context';
+import { Context, cancelWithContext } from '@dxos/context';
 import { invariant } from '@dxos/invariant';
 import { log } from '@dxos/log';
 import { InvalidInvitationExtensionRoleError } from '@dxos/protocols';
@@ -97,10 +97,12 @@ export class InvitationGuestExtension
       await cancelWithContext(this._ctx, this._remoteOptionsTrigger.wait({ timeout: OPTIONS_TIMEOUT }));
       log.verbose('options received');
       if (this._remoteOptions?.role !== InvitationOptions.Role.HOST) {
-        throw new InvalidInvitationExtensionRoleError(undefined, {
-          expected: InvitationOptions.Role.HOST,
-          remoteOptions: this._remoteOptions,
-          remotePeerId: context.remotePeerId,
+        throw new InvalidInvitationExtensionRoleError({
+          context: {
+            expected: InvitationOptions.Role.HOST,
+            remoteOptions: this._remoteOptions,
+            remotePeerId: context.remotePeerId,
+          },
         });
       }
 

package/src/packlets/invitations/invitation-host-extension.ts

@@ -3,9 +3,9 @@
 //
 
 import { type Mutex, type MutexGuard, Trigger, scheduleTask } from '@dxos/async';
-import { cancelWithContext, Context } from '@dxos/context';
+import { Context, cancelWithContext } from '@dxos/context';
 import { randomBytes, verify } from '@dxos/crypto';
-import { invariant, InvariantViolation } from '@dxos/invariant';
+import { InvariantViolation, invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { InvalidInvitationExtensionRoleError, trace } from '@dxos/protocols';
@@ -245,10 +245,12 @@ export class InvitationHostExtension
       await cancelWithContext(this._ctx, this._remoteOptionsTrigger.wait({ timeout: OPTIONS_TIMEOUT }));
       log.verbose('options received');
       if (this._remoteOptions?.role !== InvitationOptions.Role.GUEST) {
-        throw new InvalidInvitationExtensionRoleError(undefined, {
-          expected: InvitationOptions.Role.GUEST,
-          remoteOptions: this._remoteOptions,
-          remotePeerId: context.remotePeerId,
+        throw new InvalidInvitationExtensionRoleError({
+          context: {
+            expected: InvitationOptions.Role.GUEST,
+            remoteOptions: this._remoteOptions,
+            remotePeerId: context.remotePeerId,
+          },
         });
       }
       this._callbacks.onStateUpdate(Invitation.State.CONNECTED);

package/src/packlets/invitations/invitation-protocol.ts

@@ -3,9 +3,8 @@
 //
 
 import { type PublicKey } from '@dxos/keys';
-import type { ApiError } from '@dxos/protocols';
 import type { Invitation } from '@dxos/protocols/proto/dxos/client/services';
-import type { ProfileDocument, DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
+import type { DeviceProfileDocument, ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import type {
   AdmissionRequest,
   AdmissionResponse,
@@ -26,7 +25,7 @@ export interface InvitationProtocol {
   // Host
   //
 
-  checkCanInviteNewMembers(): ApiError | undefined;
+  checkCanInviteNewMembers(): Error | undefined;
 
   /**
    * Protocol-specific information to include in the invitation.
@@ -58,7 +57,7 @@ export interface InvitationProtocol {
    *
    * For example, the guest may already be a member of the space.
    */
-  checkInvitation(invitation: Partial<Invitation>): ApiError | undefined;
+  checkInvitation(invitation: Partial<Invitation>): Error | undefined;
 
   /**
    * Get profile information to send to the host to identify the guest.

package/src/packlets/invitations/invitations-handler.test.ts

@@ -2,19 +2,20 @@
 // Copyright 2024 DXOS.org
 //
 
-import { beforeEach, onTestFinished, describe, expect, test } from 'vitest';
+import { beforeEach, describe, expect, onTestFinished, test } from 'vitest';
 
-import { type PushStream, sleep, Trigger, waitForCondition } from '@dxos/async';
+import { type PushStream, Trigger, sleep, waitForCondition } from '@dxos/async';
 import { Context } from '@dxos/context';
 import { PublicKey } from '@dxos/keys';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import { openAndClose } from '@dxos/test-utils';
 import { range } from '@dxos/util';
 
+import { TestBuilder, type TestPeer } from '../testing';
+
 import { type InvitationProtocol } from './invitation-protocol';
 import { InvitationsHandler } from './invitations-handler';
 import { SpaceInvitationProtocol } from './space-invitation-protocol';
-import { TestBuilder, type TestPeer } from '../testing';
 
 interface PeerSetup {
   ctx: Context;
@@ -94,7 +95,7 @@ describe.skipIf(process.env.CI && !process.env.RUN_FLAKY_TESTS)(
         await acceptInvitation(guest, invitation);
 
         await guest.sink.waitFor(Invitation.State.READY_FOR_AUTHENTICATION);
-        await guest.peer.networkManager.close();
+        await guest.peer.networkManager.close(Context.default());
         await host.sink.waitFor(Invitation.State.CONNECTING);
 
         await sleep(10);
@@ -253,9 +254,9 @@ describe.skipIf(process.env.CI && !process.env.RUN_FLAKY_TESTS)(
       const peer = testBuilder.createPeer();
       await peer.createIdentity();
       await openAndClose(peer.echoHost, peer.dataSpaceManager);
-      await peer.echoHost.addReplicator(peer.meshEchoReplicator);
+      await peer.echoHost.addReplicator(Context.default(), peer.meshEchoReplicator);
       if (spaceKey == null) {
-        const space = await peer.dataSpaceManager.createSpace();
+        const space = await peer.dataSpaceManager.createSpace(new Context());
         spaceKey = space.key;
       }
       const invitationHandler = new InvitationsHandler(peer.networkManager, undefined, {
@@ -358,7 +359,7 @@ describe.skipIf(process.env.CI && !process.env.RUN_FLAKY_TESTS)(
     };
 
     const createInvitation = async (setup: PeerSetup, options?: Partial<Invitation>): Promise<Invitation> => {
-      const observable = await setup.peer.invitationsManager.createInvitation({
+      const observable = await setup.peer.invitationsManager.createInvitation(setup.ctx, {
         type: Invitation.Type.DELEGATED,
         kind: Invitation.Kind.SPACE,
         authMethod: Invitation.AuthMethod.SHARED_SECRET,

package/src/packlets/invitations/invitations-handler.ts

@@ -2,7 +2,7 @@
 // Copyright 2022 DXOS.org
 //
 
-import { type PushStream, scheduleTask, TimeoutError, type Trigger } from '@dxos/async';
+import { type PushStream, TimeoutError, type Trigger, scheduleTask } from '@dxos/async';
 import { INVITATION_TIMEOUT, getExpirationTime } from '@dxos/client-protocol';
 import { type Context, ContextDisposedError } from '@dxos/context';
 import { createKeyPair, sign } from '@dxos/crypto';
@@ -10,19 +10,19 @@ import { type EdgeHttpClient } from '@dxos/edge-client';
 import { invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
-import { createTeleportProtocolFactory, type SwarmNetworkManager, type SwarmConnection } from '@dxos/network-manager';
+import { type SwarmConnection, type SwarmNetworkManager, createTeleportProtocolFactory } from '@dxos/network-manager';
 import { InvalidInvitationError, InvalidInvitationExtensionRoleError, trace } from '@dxos/protocols';
 import { type AdmissionKeypair, Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import { type DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { AuthenticationResponse, type IntroductionResponse } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { InvitationOptions } from '@dxos/protocols/proto/dxos/halo/invitations';
-import { type ExtensionContext, type TeleportExtension, type TeleportParams } from '@dxos/teleport';
+import { type ExtensionContext, type TeleportExtension, type TeleportProps } from '@dxos/teleport';
 import { trace as _trace } from '@dxos/tracing';
 import { ComplexSet } from '@dxos/util';
 
 import { type EdgeInvitationConfig, EdgeInvitationHandler } from './edge-invitation-handler';
 import { InvitationGuestExtension } from './invitation-guest-extenstion';
-import { InvitationHostExtension, isAuthenticationRequired, MAX_OTP_ATTEMPTS } from './invitation-host-extension';
+import { InvitationHostExtension, MAX_OTP_ATTEMPTS, isAuthenticationRequired } from './invitation-host-extension';
 import { type InvitationProtocol } from './invitation-protocol';
 import { createGuardedInvitationState } from './invitation-state';
 import { InvitationTopology } from './invitation-topology';
@@ -31,8 +31,8 @@ const metrics = _trace.metrics;
 
 const MAX_DELEGATED_INVITATION_HOST_TRIES = 3;
 
-export type InvitationConnectionParams = {
-  teleport: Partial<TeleportParams>;
+export type InvitationConnectionProps = {
+  teleport: Partial<TeleportProps>;
   edgeInvitations?: EdgeInvitationConfig;
 };
 
@@ -71,7 +71,7 @@ export class InvitationsHandler {
   constructor(
     private readonly _networkManager: SwarmNetworkManager,
     private readonly _edgeClient?: EdgeHttpClient,
-    private readonly _connectionParams?: InvitationConnectionParams,
+    private readonly _connectionProps?: InvitationConnectionProps,
   ) {}
 
   handleInvitationFlow(
@@ -200,7 +200,7 @@ export class InvitationsHandler {
         ctx,
         async () => {
           // ensure the swarm is closed before changing state and closing the stream.
-          await swarmConnection.close();
+          await swarmConnection.close(ctx);
           guardedState.set(null, Invitation.State.EXPIRED);
           metrics.increment('dxos.invitation.expired');
           await ctx.dispose();
@@ -388,7 +388,7 @@ export class InvitationsHandler {
       return extension;
     };
 
-    const edgeInvitationHandler = new EdgeInvitationHandler(this._connectionParams?.edgeInvitations, this._edgeClient, {
+    const edgeInvitationHandler = new EdgeInvitationHandler(this._connectionProps?.edgeInvitations, this._edgeClient, {
       onInvitationSuccess: async (admissionResponse, admissionRequest) => {
         const result = await protocol.accept(admissionResponse, admissionRequest);
         log.info('admitted by edge', { ...protocol.toJSON() });
@@ -436,15 +436,15 @@ export class InvitationsHandler {
     } else {
       label = `invitation host for space ${invitation.spaceKey?.truncate()}`;
     }
-    const swarmConnection = await this._networkManager.joinSwarm({
+    const swarmConnection = await this._networkManager.joinSwarm(ctx, {
       topic: invitation.swarmKey,
       protocolProvider: createTeleportProtocolFactory(async (teleport) => {
         teleport.addExtension('dxos.halo.invitations', extensionFactory());
-      }, this._connectionParams?.teleport),
+      }, this._connectionProps?.teleport),
       topology: new InvitationTopology(role),
       label,
     });
-    ctx.onDispose(() => swarmConnection.close());
+    ctx.onDispose(() => swarmConnection.close(ctx));
     return swarmConnection;
   }
 
@@ -503,7 +503,7 @@ export class InvitationsHandler {
 const checkInvitation = (protocol: InvitationProtocol, invitation: Partial<Invitation>) => {
   const expiresOn = getExpirationTime(invitation);
   if (expiresOn && expiresOn.getTime() < Date.now()) {
-    return new InvalidInvitationError('Invitation already expired.');
+    return new InvalidInvitationError({ message: 'Invitation already expired.' });
   }
   return protocol.checkInvitation(invitation);
 };

package/src/packlets/invitations/invitations-manager.ts

@@ -4,14 +4,14 @@
 
 import { Event, PushStream, TimeoutError, Trigger } from '@dxos/async';
 import {
-  AuthenticatingInvitation,
   AUTHENTICATION_CODE_LENGTH,
+  AuthenticatingInvitation,
   CancellableInvitation,
   INVITATION_TIMEOUT,
 } from '@dxos/client-protocol';
 import { Context } from '@dxos/context';
 import { generatePasscode } from '@dxos/credentials';
-import { hasInvitationExpired, type MetadataStore } from '@dxos/echo-pipeline';
+import { type MetadataStore, hasInvitationExpired } from '@dxos/echo-pipeline';
 import { invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
@@ -21,14 +21,16 @@ import {
   Invitation,
 } from '@dxos/protocols/proto/dxos/client/services';
 import { SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
+import { trace } from '@dxos/tracing';
 
 import type { InvitationProtocol } from './invitation-protocol';
-import { createAdmissionKeypair, type InvitationsHandler } from './invitations-handler';
+import { type InvitationsHandler, createAdmissionKeypair } from './invitations-handler';
 
 /**
  * Entry point for creating and accepting invitations, keeps track of existing invitation set and
  * emits events when the set changes.
  */
+@trace.resource()
 export class InvitationsManager {
   private readonly _createInvitations = new Map<string, CancellableInvitation>();
   private readonly _acceptInvitations = new Map<string, AuthenticatingInvitation>();
@@ -48,7 +50,11 @@ export class InvitationsManager {
     private readonly _metadataStore: MetadataStore,
   ) {}
 
-  async createInvitation(options: Partial<Invitation> & Pick<Invitation, 'kind'>): Promise<CancellableInvitation> {
+  @trace.span({ showInBrowserTimeline: true })
+  async createInvitation(
+    ctx: Context,
+    options: Partial<Invitation> & Pick<Invitation, 'kind'>,
+  ): Promise<CancellableInvitation> {
     if (options.invitationId) {
       const existingInvitation = this._createInvitations.get(options.invitationId);
       if (existingInvitation) {
@@ -63,7 +69,11 @@ export class InvitationsManager {
     }
     const invitation = this._createInvitation(handler, options);
 
-    const { ctx, stream, observableInvitation } = this._createObservableInvitation(handler, invitation);
+    const {
+      ctx: invitationCtx,
+      stream,
+      observableInvitation,
+    } = this._createObservableInvitation(ctx, handler, invitation);
 
     this._createInvitations.set(invitation.invitationId, observableInvitation);
     this.invitationCreated.emit(invitation);
@@ -84,12 +94,12 @@ export class InvitationsManager {
       return observableInvitation;
     }
 
-    this._invitationsHandler.handleInvitationFlow(ctx, stream, handler, observableInvitation.get());
+    this._invitationsHandler.handleInvitationFlow(invitationCtx, stream, handler, observableInvitation.get());
 
     return observableInvitation;
   }
 
-  async loadPersistentInvitations(): Promise<{ invitations: Invitation[] }> {
+  async loadPersistentInvitations(ctx: Context): Promise<{ invitations: Invitation[] }> {
     if (this._persistentInvitationsLoaded) {
       const invitations = this.getCreatedInvitations().filter((i) => i.persistent);
       return { invitations };
@@ -101,7 +111,7 @@ export class InvitationsManager {
 
       const loadTasks = freshInvitations.map((persistentInvitation) => {
         invariant(!this._createInvitations.get(persistentInvitation.invitationId), 'invitation already exists');
-        return this.createInvitation({ ...persistentInvitation, persistent: false });
+        return this.createInvitation(ctx, { ...persistentInvitation, persistent: false });
       });
       const cInvitations = await Promise.all(loadTasks);
 
@@ -115,7 +125,7 @@ export class InvitationsManager {
     }
   }
 
-  acceptInvitation(request: AcceptInvitationRequest): AuthenticatingInvitation {
+  acceptInvitation(_ctx: Context, request: AcceptInvitationRequest): AuthenticatingInvitation {
     const options = request.invitation;
     const existingInvitation = this._acceptInvitations.get(options.invitationId);
     if (existingInvitation) {
@@ -123,8 +133,20 @@ export class InvitationsManager {
     }
 
     const handler = this._getHandler(options);
-    const { ctx, invitation, stream, otpEnteredTrigger } = this._createObservableAcceptingInvitation(handler, options);
-    this._invitationsHandler.acceptInvitation(ctx, stream, handler, options, otpEnteredTrigger, request.deviceProfile);
+    const {
+      ctx: invitationCtx,
+      invitation,
+      stream,
+      otpEnteredTrigger,
+    } = this._createObservableAcceptingInvitation(handler, options);
+    this._invitationsHandler.acceptInvitation(
+      invitationCtx,
+      stream,
+      handler,
+      options,
+      otpEnteredTrigger,
+      request.deviceProfile,
+    );
     this._acceptInvitations.set(invitation.get().invitationId, invitation);
     this.invitationAccepted.emit(invitation.get());
 
@@ -198,7 +220,7 @@ export class InvitationsManager {
       state = Invitation.State.INIT,
       timeout = INVITATION_TIMEOUT,
       swarmKey = PublicKey.random(),
-      persistent = _options?.authMethod !== Invitation.AuthMethod.KNOWN_PUBLIC_KEY, // default no not storing keypairs
+      persistent = _options?.authMethod !== Invitation.AuthMethod.KNOWN_PUBLIC_KEY,
       created = new Date(),
       guestKeypair = undefined,
       role = SpaceMember.Role.ADMIN,
@@ -232,17 +254,18 @@ export class InvitationsManager {
   }
 
   private _createObservableInvitation(
+    ctx: Context,
     handler: InvitationProtocol,
     invitation: Invitation,
   ): { ctx: Context; stream: PushStream<Invitation>; observableInvitation: CancellableInvitation } {
     const stream = new PushStream<Invitation>();
-    const ctx = new Context({
+    const invitationCtx = ctx.derive({
       onError: (err) => {
         stream.error(err);
-        void ctx.dispose();
+        void invitationCtx.dispose();
       },
     });
-    ctx.onDispose(() => {
+    invitationCtx.onDispose(() => {
       log('complete', { ...handler.toJSON() });
       stream.complete();
     });
@@ -251,10 +274,10 @@ export class InvitationsManager {
       subscriber: stream.observable,
       onCancel: async () => {
         stream.next({ ...invitation, state: Invitation.State.CANCELLED });
-        await ctx.dispose();
+        await invitationCtx.dispose();
       },
     });
-    return { ctx, stream, observableInvitation };
+    return { ctx: invitationCtx, stream, observableInvitation };
   }
 
   private _createObservableAcceptingInvitation(

package/src/packlets/invitations/invitations-service.ts

@@ -4,8 +4,8 @@
 
 import { Stream } from '@dxos/codec-protobuf/stream';
 import {
-  type AuthenticationRequest,
   type AcceptInvitationRequest,
+  type AuthenticationRequest,
   type Invitation,
   type InvitationsService,
   QueryInvitationsResponse,
@@ -28,9 +28,9 @@ export class InvitationsServiceImpl implements InvitationsService {
   }
 
   createInvitation(options: Invitation): Stream<Invitation> {
-    return new Stream<Invitation>(({ next, close }) => {
+    return new Stream<Invitation>(({ ctx, next, close }) => {
       void this._invitationsManager
-        .createInvitation(options)
+        .createInvitation(ctx, options)
         .then((invitation) => {
           trace.metrics.increment('dxos.invitation.created');
           invitation.subscribe(next, close, close);
@@ -40,8 +40,8 @@ export class InvitationsServiceImpl implements InvitationsService {
   }
 
   acceptInvitation(request: AcceptInvitationRequest): Stream<Invitation> {
-    const invitation = this._invitationsManager.acceptInvitation(request);
-    return new Stream<Invitation>(({ next, close }) => {
+    return new Stream<Invitation>(({ ctx, next, close }) => {
+      const invitation = this._invitationsManager.acceptInvitation(ctx, request);
       invitation.subscribe(next, close, close);
     });
   }